Nobani Co Listed by Deadlock Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On June 15, 2026, the Deadlock ransomware group listed Nobani Co on its leak site and stated that internal files had been exfiltrated from the firm. No figure for the number of people affected has been released, and details on the timing of the intrusion, the volume of data taken, or the techniques used remain undisclosed. The incident adds to a pattern of ransomware operations that focus on professional services firms holding client records. Such listings are treated as claims by the posting group until corroborated by the affected organization or independent investigation.

Inside the incident

Nobani Co is described in the listing as the target of a ransomware attack that resulted in the removal of internal files. The reported date marks only when the listing appeared; the actual period of unauthorized access and any subsequent encryption or demands have not been confirmed publicly. No information on the number of records involved or the specific systems accessed has been provided.

Inside Deadlock

Deadlock operates as a ransomware group that combines file encryption with data exfiltration. It maintains a public leak site where it posts the names of claimed victims and, in some cases, sample files to increase pressure during negotiations. The group follows tactics observed across multiple ransomware operations that seek both ransom payments and secondary leverage through threatened disclosure of stolen material.

The entry for Nobani Co constitutes the group’s claim of responsibility. No independent confirmation of the intrusion or the data removal has been issued by the firm or by investigators.

Nobani Co and its sector

Nobani Co is a professional financial services firm founded in 1994 and based in Amman, Jordan. It operates as an independent member of the Praxity international alliance of accounting and advisory firms. Organizations of this type routinely manage client financial statements, tax documentation, audit records, and correspondence that can contain identifying and transactional details.

Incidents at firms holding such records carry implications for client confidentiality and regulatory obligations under data-protection frameworks applicable in Jordan and in jurisdictions where its clients conduct business.

What was likely exposed

The only data category named in connection with the listing is internal files exfiltrated during the ransomware attack. The precise contents of those files have not been described. Firms in this sector commonly store client financial information, identification documents, and internal operational records, yet the exact composition of any material removed in this case remains unconfirmed.

The real-world impact

Individuals whose information appears in the exfiltrated files could face risks of targeted fraud or misuse of financial details, though the absence of confirmed data types limits any precise assessment. For the organization, the incident may trigger regulatory inquiries, contractual notifications to clients, and costs associated with investigation and remediation. No statements on ransom demands or payment have been released.

If your data was in this claimed breach

Individuals concerned about possible exposure should begin by monitoring their financial accounts and credit reports for unusual activity. Changing passwords for any accounts linked to the firm and enabling multi-factor authentication where available are standard initial measures. Contacting Nobani Co directly can provide information on any notifications the firm issues to affected clients.

Readers may also run a free exposure scan of their email address against known breach data sets to check for prior appearances of their information.

• Review bank and credit-card statements for unrecognized transactions.
• Request credit reports from available agencies and place fraud alerts if warranted.
• Update passwords and enable multi-factor authentication on financial and email accounts.
• Retain records of any correspondence with Nobani Co regarding the incident.

AICompiled with AI assistance from public sources and published under our editorial standards.